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Claim Rejections - 35 U.S.C. 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for 
the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in a patent granted on an application for patent by another filed in the 
United States before the invention thereof by the applicant for patent, or on an international application 
by another who has fulfilled the requirements of paragraphs (1), (2), and (4) of section 371(c) of this 
title before the invention thereof by the applicant for patent. 

The changes made to 35 U.S.C. 102(e) by the American Inventors Protection Act of 1999 (AlPA) 
and the Intellectual Property and High Technology Technical Amendments Act of 2002 do not apply when 
the reference is a U.S. patent resulting directly or indirectly from an international application filed before 
November 29, 2000. Therefore, the prior art date of the reference is determined under 35 U.S.C. 102(e) 
prior to the amendment by the AlPA (pre-AlPA 35 U.S.C. 102(e)). 

Claims 1,4-6, 8, 9, 12-14, 16 are rejected under 35 U.S.C. 102(e) as being anticipated by De 
Vries (6,928,428). 

Regarding Claim 1, De Vries discloses a method for protecting an item of private information in a 
database, wherein the method comprises: 

receiving (input data set. When the data is inputted to the system, it means the system receives 
the data) the item of private information (Col. 5, lines 3-24), wherein the item of private information is 
used as a key for retrieving data from the database (Col. 2, lines 14-18); 

creating a hash of the item of private information at a database (Col. 2, lines 1-18), wherein 
creating the hash further comprises checking a column attribute for a column, which stores the item of 
private information, in the database to determine that "privacy" is enabled for the column, and only upon 
privacy being enabled for the column ("...input data set 310. ..as a flat database table in row/colum format 
(i.e., where columns represent fields of the input data, such as contact name...". Col. 5, lines 3-24)^ , 



^ De Vries teaches that the input data set as the item of private information stored in the column of the 
table. 
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creating the hash, and wherein the hash is a one-way hash ("...produces a hash value that is one-way 
hashing function of at least some of the input data set fields. . .", Col. 5, lines 24-35); and 

storing the hash of the item of private information in the database (Col. 5, lines 3-35), wherein the 
hash of the item of private information (refer to "confidential information" such as contact name, calendar 
date/time, location, etc) is a unique lookup key within the database ("the query data structure 220 takes 
the form of a set of query hash and answer pairs, which is constructed from an input data set 31 0 that 
represents the user context data 210...", Col. 5, lines 3-24 and "...using the resulting query hash as a look 
up index to the associated answer in the querying data structure, and acting on the answer...", Abstract), 
and wherein the item of private information does not exist in the database in plain-text form (" without 
making the confidential information available to un-trusted information processing servers in an intelligible 
form (i.e. plain text)". Col. 1 , lines 59-63). 

Regarding Claim 4, De Vries discloses that processing a query containing the private information 
involves: 

receiving (input data set. When the data is inputted to the system, it means the system receives 
the data) the item of private information (Col. 5, lines 3-24); 

creating a hash of the item of private information ("...query hash and answer pairs... are 
produced...", "The resulting query hash value". Col. 5, lines 3-35; Col. 2, lines 1-18); and 

querying the database using the hash of the item of private information ("querying of confidential 
information", "hashing the query", using the resulting query hash", "to the query hashes in the query data 
structure by reverse hash", Abstract; Fig. 3; Col. 2, lines 7-18; ). 

Regarding Claim 5, De Vries discloses that the item of private information can include a person's 
name ("contact name". Col. 5, lines 3-13). 

Regarding Claim 6, De Vries discloses that multiple items ("input data, such as contact name, 
calendar date/time, location, etc.". Col. 5, lines 3-13) of private information can be combined prior to 
creating the hash (Examiner's note: the input data is prior to the hash. See Col. 5, lines 24-35). 
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Regarding Claim 8, De Vries discloses that the database is a Lightweight Directory Access 
Protocol (LDAP) database ("...devices 120-123 and information services can use standard data 
networking protcols...LDAP", Col. 3, lines 29-33). 

Regarding Claim 9, as discussed in detailsin the preceding rejection of claim 1, De Vries meets 
the limitation of claim 9. 

Regarding Claim 12, as discussed in details in the preceding rejection of claim 4, De Vries meets 
the limitation of claim 12. 

Regarding Claim 13, as discussed in details in the preceding rejection of claim 5, De Vries meets 
the limitation of claim 13. 

Regarding Claim 14, as discussed in details in the preceding rejection of claim 6, De Vries meets 
the limitation of claim 14. 

Regarding Claim 16, as discussed in details in the preceding rejection of claim 8, De Vries meets 
the limitation of claim 16. 

Claim Rejections - 35 U.S.C. 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all obviousness 

rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not Identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the phor art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

Claims 2 and 10 are rejected under 35 U.S.C. 103(a) as being unpatentable over De Vries 
(6,928,428) in view of the term dictionary in Javvin (This reference has been made in record. Please see 
previous Form 892 dated 02/05/2008). 

Regarding Claims 2 and 10, De Vries essentially discloses the claimed invention but does not 
explicitly disclose creating the hash can include creating either Secure Hash Algorithm-1 (SHA-1) or 
Message-Digest algorithm 5 (MD5) hash. However, Javvin dictionary teaches that Message-Digest 
algorithm 5 (MD5) (designed in 1991 ) is a popular algorithm in security application and to check the 
integrity of files. And Javvin also discloses that SHA-1 is recommended by cryptographers to overcome 
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some flaws in MD5. It would have been obvious to one of ordinary skill in the art at the time the invention 
has been made to use either MD5 or SHA-1 in De Vries in order to provide additional security purpose 
since both MD5 and SHA-1 are widely used and known to a skilled in the art. 

Claims 2 and 10 are rejected under 35 U.S.C. 103(a) as being unpatentable over De Vries 
(6,928,428) in view of Tuvey et al. (2002/001 9849). 

Regarding Claims 2 and 10, De Vries essentially discloses the claimed invention but does not 
explicitly disclose creating the hash can include creating either Secure Hash Algorithm-1 (SHA-1) or 
Message-Digest algorithm 5 (MD5) hash. However, Tuvey teaches that Message Digest algorithm 5 
(MD5) is one way hash algorithm being used for resisting collision (paragraph 0053). It would have been 
obvious to one of ordinary skill in the art to have used MD5 such standard one way hash algorithm in De 
Vries in order to resist collision as taught by Tuvey. 

Claims 3 and 1 1 are rejected under 35 U.S.C. 103(a) as being unpatentable over De Vries 
(6,928,428) in view of Trostle (5,919,257) (This reference has been made in record. Please see previous 
Form 892 dated 02/05/2008). 

Regarding Claims 3 and 11 , De Vries discloses that the hash of the item of the private 
information^ or confidential information is produced before performing the lookup ("...query comprising a 
set of the query input values is hashed. ..The hash result of the query is used as look-up into the set of the 
query...". Col. 2, lines 7-18). De Vries' above teaching matches the definition of "transparent to 
application" written in the instant specification on Page 6, line 23 to Page 7, line 2. 

Although De Vries does not literally write the words "transparent to an application", however, 
Trostle discloses a networked workstation for detecting intrusion to provide a more secure user friendly 
technique. Trostle teaches an advantage of transparency is such as detecting illicit changes to the 
executable files resident on the workstation (Col. 3, lines 23-30). It would have been obvious to one of 
ordinary skill in the art to have used Trostle's transparency method in De Vries in order to attain the 
advantage of detecting illicit changes on the workstation as taught by Trostle. 



^ In Col. 2, line 12, De Vries teaches that the data is confidential information which means private 
information. 
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Response to Arguments 

Applicant's arguments with respect to claims 1-6, 8-14, 16 have been considered but are moot in 

view of the new ground(s) of rejection. 

Conclusion 

Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. 
Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing 
date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and 
the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory 
period for reply expire later than SIX MONTHS from the date of this final action. 

Correspondence 

Any inquiry concerning this communication or earlier communications from the examiner should 
be directed to Examiner Wilson Lee whose telephone number is (571) 272-1824. 

Papers related to the application may be submitted by facsimile transmission. Any transmission 
not to be considered an official response must be clearly marked "DRAFT". The official fax number is 
(571)273-8300. 

Information regarding the status of an application may be obtained from the Patent Application 
Retrieval (PAIR) system. Status information for published applications may be obtained from either 
Private PAIR or Public PAIR. Status information for unpublished applications is available through Private 
PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.qov . Should you 
have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 
866-217-9197 (toll-free). 
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